CVE-2023-37131 in YznCMS
Summary
by MITRE • 07/06/2023
A Cross-Site Request Forgery (CSRF) in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers to arbitrarily change the Administrator password via a crafted POST request.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/16/2026
The vulnerability identified as CVE-2023-37131 represents a critical Cross-Site Request Forgery flaw within the YznCMS v1.1.0 content management system. This weakness specifically affects the administrative profile update component located at /public/admin/profile/update.html, where the application fails to implement proper CSRF protection mechanisms. The flaw enables authenticated attackers to manipulate administrative accounts by exploiting the absence of anti-CSRF tokens or validation checks in the password change functionality.
The technical implementation of this vulnerability stems from the application's failure to validate the origin of requests made to the profile update endpoint. When an administrator performs a password change operation, the system should verify that the request originates from a legitimate administrative session rather than being submitted through a maliciously crafted web page. Without proper CSRF protection, an attacker can construct a malicious webpage containing a hidden form submission that targets the vulnerable endpoint, potentially allowing unauthorized password changes without the administrator's knowledge or consent.
This vulnerability operates under the Common Weakness Enumeration category CWE-352, which specifically addresses Cross-Site Request Forgery weaknesses in web applications. The operational impact of this flaw is severe as it directly compromises the administrative integrity of the CMS system. An attacker who successfully exploits this vulnerability gains the ability to reset administrator passwords, effectively taking complete control of the web application. This provides unauthorized access to all administrative functions including content management, user administration, and system configuration settings.
The attack vector for this vulnerability typically involves social engineering techniques where an administrator is tricked into visiting a malicious website that contains embedded malicious requests. According to the MITRE ATT&CK framework, this vulnerability aligns with the technique T1531 - Account Access Removal and T1078 - Valid Accounts, as it enables unauthorized access to administrative accounts through compromised credentials. The exploitation process requires minimal technical expertise and can be automated, making it particularly dangerous for organizations running unpatched versions of YznCMS.
Mitigation strategies for this vulnerability should include immediate implementation of anti-CSRF tokens within the administrative profile update endpoint. The system must generate unique, unpredictable tokens for each administrative session and validate these tokens upon form submission. Additionally, organizations should implement proper request origin validation and consider implementing SameSite cookies for enhanced protection. Regular security audits and vulnerability assessments should be conducted to identify similar weaknesses in other application components. The vendor should release a patched version addressing this specific CSRF vulnerability, and all users should be advised to upgrade to the latest secure version of YznCMS to prevent exploitation attempts.